MNO Identity Management Service. (UC 1.4) Summary: In this use case, the Mobile Network Operator provides an identity management service to a 3rd party service provider on behalf of a user. Consider for instance, a bank is the third party and Bob is a mobile network subscriber and a bank client who signed up to this service. The main idea is to provide the bank with anonymized information about Bob’s network context in order to enable the bank to adjust its security policies, hence, it offers and guarantees the same security level of its service (banking service). For instance, the bank may require additional authentication measures if Bob is connected through a public hotspot. Bob’s network context information encompasses the access network type, the equipment, the authentication scheme used and the location. Entities: The entities implicated in this use case are the mobile network operator, a service provider such as a bank and a user who is using the mobile network, the bank service and the new service provided by the network operator. Trust: In these circumstances, the bank needs to trust that the mobile network operator is providing correct information about Bob. In the same time, Bob needs to trust that the mobile operator is anonymizing his information in order to preserve Bob’s privacy. This type of trust can be ensured through technical solutions such as k-anonymization or differential privacy in addition to agreements between the entities. If the user does not any more trust the new service, this will threaten the trust that the user has in the basic network operator service (i.e. telecommunications). If the service provider does not trust any more the quality of the information provided by the mobile network operator services, this may lead to stopping the new service.
